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-Abstract- 

Herman’s self-stabilization algorithm, introduced 25 years ago, is a well-studied synchronous 
randomized protocol for enabling a ring of N processes collectively holding any odd number 
of tokens to reach a stable state in which a single token remains. Determining the worst-case 
expected time to stabilization is the central outstanding open problem about this protocol. It is 
known that there is a constant h such that any initial conhguration has expected stabilization 
time at most hN^. Ten years ago, Mclver and Morgan established a lower bound of 4/27 w 0.148 
for h, achieved with three equally-spaced tokens, and conjectured this to be the optimal value 
of h. A series of papers over the last decade gradually reduced the upper bound on h, with 
the present record (achieved in 2014) standing at approximately 0.156. In this paper, we prove 
Mclver and Morgan’s conjecture and establish that h = is indeed optimal. 
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[T] Introduction 

The notion of self-stabilization was introduced in a seminal paper of Dijkstra m, and rose to 
prominence a decade later, following (among others) an invited talk of Lamport during which 
he pointed out that “self-stabilization [is] a very important concept in fault tolerance” [^ . 
Both self-stabilization and fault tolerance have since become central themes in distributed 
computing (see, e.g., m), as recently witnessed by the award of the 2015 Edsger W. Dijkstra 
Prize in Distributed Computing to Michael Ben-Or and Michael Rabin for “starting the field 
of fault-tolerant randomized distributed algorithms” in the early 1980s. 

In this paper, we examine an early self-stabilization algorithm known as Herman’s 
Protocol m, whose exact mathematical analysis has proven remarkably challenging over the 
two-and-a-half decades since its inception. This algorithm considers a ring of N processes 
(or nodes), where each process either holds or doesn’t hold a token. Starting from any initial 
configuration of K tokens, where K is required to be odd, Herman’s algorithm proceeds 
as follows: at each time step, every process that holds a token either keeps it or passes it 
to its clockwise neighbor with probability 1/2. All updates happen synchronously, and if a 
process finds itself with two tokens (having simultaneously kept one and received one from 
its counterclockwise neighbor) then both tokens are annihilated. It is straightforward to see 
that, starting from an odd number of tokens and following this procedure, almost surely only 
one token eventually remains, at which point the ring is said to have stabilized. 

Herman’s original paper m presents the algorithm in a form amenable to implementation. 
Each process possesses a bit, which the process can read and write. Each process can also 
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read the bit of its counterclockwise neighbor. In this representation, having the same bit 
as one’s counterclockwise neighbor is interpreted as having a token. At each time step, 
each process compares its bit with the bit of its counterclockwise neighbor; if the bits differ, 
the process keeps its bit, whereas if the bits are the same, the process flips its bit with 
probability 1/2 and keeps it with probability 1/2. It is straightforward to verify that the 
bit-flipping version is an implementation of the token-passing version: in particular, a process 
flipping its bit corresponds to passing its token to its clockwise neighbor. If the number of 
processes is odd, by construction this bit representation forces the number of tokens to be 
odd as well, which justifies the assumption that K, the number of tokens, is always odd. 
In this paper we make no assumption about the parity of the number of processes, as we 
abstract from the bit implementation, and simply assume that the number of tokens is odd 
throughout. 

Herman’s original paper m showed that the expected time (number of synchronous steps) 
to stabilization is 0{N^ log N). The same paper also mentions an improved upper bound 
of 0{N'^) due to Dolev, Israeli, and Moran, without giving a proof or a further reference. 
In 2004, Fribourg et al. m established an upper bound of 2A^, and the following year 
Nakata m gave a tighter upper bound of 0.936A^^ and exhibited an initial configuration 
with expected stablization time At the same time and independently, Mclver and 

Morgan showed in that the initial configuration consisting of three equally-spaced tokens 
has an expected stabilization time of exactly and conjectured that this value is an 

upper bound on the expected time to stabilization starting from any initial configuration 
with any (odd) number of tokens. The conjecture is intriguing since increasing the initial 
number of tokens might be thought to lengthen the expected time to stabilization, due to 
the larger number of collisions required to achieve stabilization. 

Nevertheless, Mclver and Morgan’s Herman-Protocol Conjecture is supported by consid¬ 
erable amount of experimental evidence [3], and in the intervening years a series of papers 
have gradually reduced the upper bound on the constant h such that stabilization from any 
initial configuration takes expected time at most hN^: upper bounds of approximately 0.64, 
0.521, 0.167, and 0.156 are given respectively in unmiiniini, the last one provided last 
year by Haslegrave, and coming relatively close to Mclver and Morgan’s lower bound of 
4/27 « 0.148. 

In this paper, we prove Mclver and Morgan’s conjecture and establish that h = 4/27 is 
indeed optimal. Writing for the stabilization time starting from an initial configuration z, 
we seek to prove that ET^ < To this end, one of the key ideas is to work with 

a Lyapunov function V (z) in lieu of the (more complicated) function ETj,. The domain 
of the function V is eontinuous: a domain element describes a configuration in terms of 
the distances between adjacent tokens. Combinatorial arguments exploiting the highly 
symmetrical structure of V{z) enable us to establish that, for an arbitrary configuration z, 
we have ET^ < V(z), with equality holding for all three-token configurations. Finally, in 
what constitutes the most technically challenging part of this paper, we combine induction 
on the number of tokens with analytical techniques to show that V is bounded by 
Taken together, we obtain ET^ < entailing the Herman-Protocol Conjecture. 

The case of there being an even number K of tokens is equally natural from a mathematical 
point of view, although it does not correspond to a concrete bit-flipping protocol. It was 
established in m that the worst-case configuration in this variant is the equidistant two-token 
configuration, with an expected stabilization time of ^N^', the analysis underlying that result 
is considerably simpler than what is required in case the number of tokens is odd, as in the 
present paper. 
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Herman’s protocol is also related to the notion of coalescing random walks [IIHII]- There, 
one considers multiple independent random walks on Z'’* (or on the vertices of a connected 
graph). When two walks meet, they coalesce into a new random walk. A protocol for 
self-stabilizing mutual exclusion based on such random walks was proposed in jlHj . The 
expected coalescence time was studied in [ 311115 ]. 

It is interesting to note that Herman’s ring is closely related to widely-studied models 
of random walks and Brownian motion in statistical physics. Observe that by a simple 
modification of the formalism, one may equivalently view Herman’s model as a ring in which 
tokens randomly move in discrete step in any direction, with pairwise collisions leading to 
annihilation; this precisely corresponds to Fisher’s vicious drunks model |14] (with periodic 
boundary conditions). Similar models have been studied in chemical physics HHHTj and 
statistical mechanics uniiisiiis], among others. 

The rest of the paper is organized as follows. In Section]^ we review previous results in 
the literature that are relevant to our proof. In Section [^ we outline the structure of our 
proof, identifying two key lemmas. Lemma and Lemma [^ Those are proved in Appendix [A] 
and Section 1^ respectively. 

Another solution of the conjecture, using different techniques, is independently shown 
in 0. 


[Y] Relevant Previous Results 


For the rest of the paper we fix the number N of processes. We assume that the number K 
of tokens is odd, and both N and K are at least 3. 

Processes are numbered from 1 to N, clockwise, according to their position in the ring. 
A configuration with K tokens is formalized as a function z : {!,...,AT} —>■ {1,...,A^} with 
z(l) < • • • < z{K), where the Ah token (i S {1,..., K}) is held by the processor with the 
number z{i). We write Zk for the set of configurations with K tokens, and Z for the set of 
all possible configurations, that is, Z = ZiU Z^U Z^U ... 

For a fixed initial configuration z = zq we write {zt)t>o for the stochastic process of 
configurations emanating from z. The stabilization time is the smallest t > 0 such 
that zt G Zi, i.e., the time until only one token is left. In this paper we focus on the 
expectation ET^. It is shown in [22] that if N is odd and a multiple of 3, then there is a 
configuration z G Z^ (with the 3 tokens maximally separated in an equilateral triangle) such 
that ET^ = ■^N'^ ■ 

In this paper we show: 

► Theorem 1. We have ET^ < for all z G Z. 

Equivalently, the Herman conjecture states that for all odd K > 3 and all z € Zx we have 
ET), < Only the case AT = 3 was previously known [22] . 

The following proposition has been used in a similar form in various papers on Herman’s 
protocol, for instance in [221 Lemma 5]. It bounds the stabilization time by a Lyapunov 
function V. 


► Proposition 2 (Bound by a Lyapunov function). Given z G Z, denote by z' G Z the random 
successor configuration of z. Let H : Z —> K &e o function with 


E(H(z') I z) < V{z) — 1 for all z G Z \ Zi, and 

0 < V{z) for all z G Zi. 

Then ET^ < V{z) for all z G Z. In particular, V{z) >0 for all z G Z. 


( 1 ) 

( 2 ) 
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Although this result is not new, we give a short proof based on a martingale argument. The 
proof is inspired by m, and may provide some intuition. 

Proof. Let z G Z. Consider the stochastic process {zt)t>o of configurations emanating 
from z = zq. Define Wt := V{zt) + t. By 0 the process {Wt)t>o is a supermartingale. The 
stabilization time is a stopping time with finite expectation, and the differences 

|lTt_|_i — Wt\ are bounded as the Markov chain reachable from z has finitely many states. 
Hence, the optional stopping theorem applies, yielding < ElTo = V{z). By definition 

of Wt we have EWr^ = EH(zt^) + ET^. Since zt^ G Zi, we have ET^ < EWt^ by ([^. By 
combining the previous two inequalities, we obtain ET^ < H(z). ◄ 

Following [H [H] we associate with a configuration z G Zk the gap vector g(z) = 
{go, ■ ■ ■ ,gK-i) G by setting go := N + z{l) - z{K), and gt := z{i + 1) - z{i) for 
i G {1 ,... ,K — 1}. Then g{z)/N lives in the so-called standard {K — l)-simplex 
defined by 

:= {x = (a;o,... G [0,1]^ I a;o H- Vxk-i = 1]- 

Towards a suitable Lyapunov function V we define the cubic polynomial —)■ [0, oo) 

by 

Z 2 — 2 i, — io odd 


For instance, we have = xoXiX 2 + X 0 X 1 X 4 + X 0 X 3 X 4 + X 1 X 2 X 0 + X 2 X 3 X 4 . 

The following lemma was implicitly proved in previous works: 

► Lemma 3 (Lyapunov function V 3 |13l Page 240, Proof of Theorem 1] and (TT] Theorem 
4]). Let F 3 : Z —>■ [0, 00) be defined by V 3 (z) := 4N'^ f^^\g{z)/N) for z G Zk- Denote by 
z' G Zi U Z 3 U ... U Zk the random successor configuration of z G Zk- Then E(F 3 (z') | z) = 
V 3 (z) — for all z G Zk- Hence, by ProposftfonET^ < AN'^ f'^^\g,{z)/N). 

For K = 3 Lemma|^gives ET^ < f^^\^{z)/N) = ^gogig 2 - In fact, for iG = 3 it was 

shown before in m that ET^ is identically equal to go 9192 , providing an exact formula 
for the expected stabilization time of configurations with three tokens. Lemma suggests 
analyzing fo: 


► Lemma 4 (Maximum of fo |131 Proof of Theorem 2], |17l Theorem 3]). For all K >3 odd 

we have 


max/^'^^(x) = f^^^ 


xGD 




By combining Lemmas and one obtains ET^ < ^(1 — ^), which is the bound obtained 
in m- A slightly better bound is given in [17] . 


fLI Proof of the Herman Conjecture 


The function V 3 from Lemma|^leaves room for improvement since E(F 3 (z') | z) = Vo{z) — ^^^^, 
which is strictly less than F 3 (z) — 1 for K > 3- The idea for obtaining an optimal bound 
is to decrease the gap between and 1, by decreasing the Lyapunov function V- One 
could think that the scaled function is also a Lyapunov function satisfying Q, but 
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this is not true; in particular, note that the number of tokens K might be different for a 
configuration z and its successor z'. Since scaling does not work, we decrease the Lyapunov 
function by subtracting a quintic polynomial, as follows. Define a quintic polynomial 


/g : —> [0, oo), similar to /g : 

/f’w= E 


X rp . /Y» . rp . rp . 


0<io<ii<---<i4<K 

i4 — is, ■ ■ ■ ,ii — io odd 


For instance, /^^^(x) = 0, /g^^(x) = a;occia:2a^3a;4, and /^^^(x) = a;oa;ia; 2 a: 3 a ;4 + X 0 X 1 X 2 X 3 XG + 
a;oa:ia; 2 a: 5 a :6 + xoXiX 4 X 5 Xe + xoXsX^x^Xq + X 1 X 2 X 3 X 4 X 5 + a; 2 X 3 a; 4 a: 5 a; 6 - We also define a 
polynomial —> [0,oo): 

/(^)(x) := - af^^\x) with a := 24 (3) 

For example, /*^^)(x) = X 0 X 1 X 2 + X 0 X 1 X 4 + X 0 X 3 X 4 + X 1 X 2 X 3 + X 2 X 3 X 4 — axoXiX 2 X 3 X 4 . 
Throughout the paper we use a in the expression of for notational convenience. From 
now onwards we may drop the superscript K from the domain of the functions 

and to avoid notational clutter when K is understood. 

The following properties of / are fundamental: 

► Lemma 5 (Symmetry and continuity properties). The function f has the following properties. 

(a) It is symmetric with respect to rotation: 

f{xo, xk-i) = f{xi,X k-1 ,Xo) 

(b) It is continuous: For K > 5 we have 

f^^Hxo,0 , X 25 3^35 • ■ • ; ^K—l') = f^^-^Hxo + X2,X3, . . . , XK-i). 

Analogous properties were shown for /g in m- Their proof carries over to /s and hence to /. 
The following lemma uses / to define a tighter Lyapunov function. 

► Lemma 6 (Lyapunov function V). Define V : Z ^ [0, 00 ) by V(z) := 4:N‘^f{g{z)/N). Let 
z & Z and denote by z' the random successor configuration of z. ThenE,(y{z') \ z) < V{z) — 1. 
Hence, by Proposition^ ET^ < 4:N^f{g{z)/N). 

We remark that a similar Lyapunov function has been investigated in usi Equation (15)], 
but did not lead to a proof of the Herman conjecture. It seems that V{z) needs to be chosen 
with great care, since even slight variations do not work. 

Lemma suggests analyzing /: 

► Lemma 7 (Maximum of /). For all K > 3 odd we have 

With this in hand our main result follows: 


Proof of Theorem [TJ Immediate by combining Lemmas and 


It remains to prove Lemmas and 
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3.1 Proof of Lemma [6] 

Towards Lemma we show: 

► Lemma 8 (Lyapunov function V 5 ). Define V 5 : Z —>■ [0, 00 ) by ¥ 5 ( 2 ) := f 5 (^( 2 ) /N). 

Let K >5 and 2 G Z and denote by 2 ' the random successor configuration 0 / 2 . Then 

E(V4(^') I z) = + ^ (A'-1KA'-3) _ 1,^ _ 

The proof in Appendix requires an analysis of correlations among the changes in gaps 
between tokens in each step of the protocol. Using Lemma one can readily prove Lemma 

Proof of Lemma |5J For K = 3 the statement follows from Lemma For AT > 5 we have: 


E(U(z') I z) = E((U3(^0 - 24U5(^0) I 

= E(U3(z') I z)-24E(U5(z') I 2 ) 


iV2 


< V{ 2 ) - 

< V{2) - 


12(A-3)/3 
K- 1 


2 

K-1 


S{z) 

N 

12(A-3)/3 

K-3 


g(^) 

N 


by the definitions 
linearity of expectation 


Lemmas [3] and |8] 
since K >3 
Lemma H] 


= U(z) - 1 


3.2 Proof of Lemma [7] 

Towards Lemma |7] we show: 

► Lemma 9 (Local maxima of /). Let K > 5 and odd. There is no v G in the interior 
of such that v is a local maximum and /^^^(v) > 

The proof in Section [^involves a combinatorial analysis of inequalities arising from conditions 
on the derivatives of Using Lemma one can readily prove Lemma 

Proof of Lemma |7j We proceed by induction on K. For the induction base we have K = 

3. It is straightforward to check that the maximum of /'■^^(x) = /^^^(x) = X 0 X 1 X 2 is 
f(3)/l 1 I'l = i 
J V3’ 3’ 3'' 27’ 

For the induction step we have K > 5. Let v G with /^^^(v) = max^^-g^iCA) /^'^^(x). 
If V is in the interior of then by Lemma S we have < ^. If V is at the 

boundary of then Vi = 0 for some i. By Lemma |^a) we can assume that Vi = 0. 

Using Lemma ib) the statement follows from the induction hypothesis. ◄ 


Proof of Lemma 

In this section we prove Lemma In Section [4.1| we state several properties that an interior 
local maximum of would have to satisfy. In Section 4^ we prove Lemma for K = 5 
for a first taste of the general argument. In Section [4. 3 1 we prove Lemma for K = 7 to 
illustrate some fine points that occur only for larger values of K. In Section [4.4| we state some 
combinatorial facts needed for the general case. Finally, in Section [US] we prove Lemma 
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4.1 Properties of an Interior Local Maximum 


The following lemma is obtained by considering first and second derivatives of / evaluated 
at an interior local maximum. 

► Lemma 10. Let v be a local maximum of in the interior of and define c gM. by 
c = ^ Vi^ - a ^ . (4) 

l<i2<K l<i2<iz<iA<K 

12 even 12, ia even 

23 odd 


This expression holds for the same value of c if the indices are rotated by an arbitrary k: for 
all j the index ij becomes (ij + k) mod K. Further, we have 


3<23<24<i^ 

23 odd 

24 even 



( 5 ) 


Again, this inequality also holds when indices are rotated. 

For example, for K = 7 we have c = V 2 + V 4 + vq — a{v 2 V 3 V 4 + V 2 V^ve, + V 2 V^vq + V 4 V 5 VG) = 

+ f 3 + ^^5 — a{viV2V3 + V1V2V5 + V1V4V5 + V3V4V5). 


Proof of Lemma 1101 The idea of the proof is as follows. We pick a particular direction in 
D(^) , namely d = (—1, 0,1,0,0,..., 0), and consider the function /(v + ed) as a univariate 
function of e. Since v is a local maximum, the first derivative must be zero and the second 
derivative must be nonpositive. Exploiting the fact that > 0 for all i holds in the interior, 
we obtain Q and respectively. See Appendix for the detailed proof. ◄ 

Let denote the scalar product of x with a copy of itself rotated j times: 


K-l 

(x) := ^ XiX,+j 
i=0 


In all formulas it will be the case that the subscript of S is odd. Also, the superscript will be 
omitted when unimportant or understood from context. 

► Corollary 11. Let v be a local maximum of f^^^ in the interior of Then the following 

inequality holds: 


E 

l<i<K -2 
i odd 



< 


K 

a 


For example, for K = 11 we have 45i(v) + 353(v) + 255(v) + *S' 7 (v) < ll/a. 

► Lemma 12 (Bound for f^). Suppose that v € satisfies Then af^{v) < 

1 

216 ■ 

Proof. By Lemma 0 we have fsiv) < A and hence af^iv) = / 3 (v) - /(v) < ^ - ^ = 

A- .4 

216 ’ ^ 
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4.2 Proof of Lemma [5] for = 5 

Let if = 5. Then 

/(x) = /3(x) — Q!/5 (x) = X0X1X2+X0X1XA +XoXzXa +XiX2X'i+X 2 X 3 Xi — aXoXiX 2 X 3 Xi 

Towards a contradiction, suppose that there is a local maximum v with /(v) > ^ in the 
interior of D. By Q, the value 

C = V2+Vi — aV2V3V4 (6) 

is invariant under rotations. Indeed, V 2 +k + V 4 +k — oiV 2 +kV 3 +kV 4 +k = c for all k, but we 
shall avoid explicitly mentioning rotations, for notational simplicity. Summing (§ over all 
K rotations we obtain: 


5c = 2-a/3(v) (7) 

By® we have vqVic = vqViV 2 + vqViV 4 — a/ 5 (v) and, summing over all K rotations, 

cS'i(v) = 2/(v) - 3 q;/5(v) (8) 

Moreover, 


Cor.[TT] 5c ffl 2 2 

C^i(v) < ^ Lf --/3(v) = --/(v)-a/ 5 (v). 

a a a 

Combining this with gives: 


- > 3/(v)-2a/5(v) 


a 


Lemma Cl 3 1 

> - 2 •- 

27 216 


This implies a < 216/11 « 19.6, which is a contradiction as required (since ol = 24). 


4.3 Proof of Lemma [U] for iC = 7 

Let K = 7. Towards a contradiction, we suppose again that there is a local maximum v 
with /(v) > ^ in the interior of D. By all K rotations of the following hold with the 
same c S K: 

C = V 2 + V 4 + V 3 — Q;(u 2 U 3 'y 4 + V 2 V 3 V 3 + V 2 V 3 V 3 + V 4 V 3 V 3 ) (9) 

Summing ® over K rotations we obtain: 

7c = 3-2a/3(v) (10) 

By® we have 

VqViC = VoViV2+VoViV4+VoViVe — a{voViV2V3V4+VoViV2V3V3+VoViV2V5Ve+VoViV4V5Ve) (11) 


and 


V0V3C = V0V3V4 + V0V3Ve - avoV3V4V5Ve + V0V2V3{1 - a{v3V4 + Vsve + v^ve)) 


( 12 ) 


> V0V3V4 + V0V3VG - avoV3V4V3Ve 

where the last inequality is by ®. Summing © and ( |12[ ) over K rotations we obtain: 
c(2S'i(v) + 5'3 (v)) > 4/3(v) - 9q:/5(v) = 4/(v) - 5a/5(v) (13) 
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Further we have: 


c(2S'i(v) + 5'3 (v)) — 0 ^_ 2 / 3 (v) = - - 2/(v) - 2 a/ 5 (v) 

^ a a OL 


Combining this with (131 gives: 

3 Lemma |12l R 1 

- > 6/(v)-3„A(v) > --3.- 

This leads to a < 14.4, which is a contradiction as desired. 


4.4 Combinatorial Lemmas 


In order to generalize the proofs from Sections |4.2| and |4.3| to any odd we state some 
combinatorial lemmas in this subsection. They are proved in Appendix [C| 

In order to generalize ([^ and (10) we show the following lemma: 


► Lemma 13. We have: 

K-l 


E E 

k=0 


K-i 




E 




K - 3 „(ic) 


/r^(x) 


lo even 


‘‘O’ ‘‘2 

odd 


0<iQ<ii<i2<K 
22 — O; ii — io odd 


For example, if AT = 5, then we obtain that summing the 5 rotations of X 2 X 3 X 4 , gives 
/ 3 ^^(x). As another example, if AT = 7, then we obtain that summing the 7 rotations of 
X 2 X 3 X 4 + X 2 X 3 XQ + X 2 X 5 Xe + X 4 X 5 Xe gives 2/3 Tx). These two instances of Lemma 13 help 
establish Q and (lOl. 

In order to generalize the inequality in © we need the following lemma: 


► Lemma 14. Letv be a local maximum of in the interior of If ii is odd and 

0 < ii < K, then the following inequality holds: 


VoV^i ( E '*^*2 

n<i 2 <K 
12 even 




OLVi^Vi^Vf 


1<22<^3<^4<J^ 
22,^4 even 
23 odd 


> VoVi^ 


^2l<22<^ 
22 even 



Vi 2 


- E 


O.Virj Vio Vd, 


ii<i2<io<i4:<K 
22,24 even 
23 odd 


The inequality says that if we drop those terms that do not occur in f^^^ or f^^\ then we 
obtain a lower bound. The proof groups those terms that are not in either of f^^^ or f^^\ 
and then invokes to show that their sum is nonnegative. 

In order to generalize (§ and ( |13[ ) we need Corollary below, which is a consequence of 
the following lemma: 

► Lemma 15. Let I be an odd, positive integer. Then: 


K-l 

E E 

k^O l<i[<K-2 
i\ odd 


K-i[-2 ^ 

(mod 2 ) 


l<j<l 


1-1 


K - 


0 E 


O<2o<‘"<^2-1<^ 
ij — ij — i odd for 0 <. j < I 


1-1 

i=o 
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For example, if iF = 5 and I = 3, then we have that summing 5 rotations of X0X1X2 + xqXix^ 
gives 2 / 3 ^\x). As another example, if A = 9 and I = 3, then summing 9 rotations of 
3xoXi{x2 + XA + XQ + a; 8 ) + 20 : 0 X 3 ( 0:4 + xe + xs) + xoX 5 (x 6 + xs) gives 6 / 3 ®^(x). 

► Corollary 16. We have: 

^ ^ A—zi-2 ^ xo+feXii+fcXi,+fc = (A-3)/;^^^(x) 

fc—0 l<ii<.K —2 zi<Z2<i^ 

ii odd 12 even 

and also 

K-ii -2 K 

^xo+kXi^+kXi^+kX^^+kXu+k = { 2 K- 5 )f^^\-K) 

k —0 l<ii<K —2 2i<Z2<'i3<'i4<^ 

ii odd even 

23 odd 


Proof. Instantiate Lemma 15 with I = 3 and, respectively, I = 5. 


•4 


4.5 Proof of Lemma 

Towards a contradiction, suppose that there is a local maximum v with /(v) > in the 
interior of D, i.e., Ui > 0 for all i € {0,..., A — 1}. Summing up the A rotations of 0 and 
using Lemma [TSl we obtain: 


= — - T^afsiv) 


(14) 


Multiplying Q on both sides by X)i<*i <^-2 ^ 2 we obtain: 

ii odd 


K — i\ — 2 K — i\ — 2 / \ 

■ 2 ^ - 2 -^ ^ - 2 - 1 ^*2 - 2 ^ oLv^^Vi^Vi^ 1 

l<i\<K —2 l<ix<K —2 \l<22<i^^ l< 22 <'i 3 <^ 4 <^ / 

i\ odd ii odd 22 even 22, 24 even 

23 odd 

^ - -T- -'^0V^, i Vi2- 


l<ii<K-2 
2 i odd 


\il<i2<K 2i<22<23<24<A' 
22 even 22 , 24 even 

23 odd 


using Lemma Summing A rotations of this inequality yields: 


~—T-> (A- 3 )/ 3 (v) - (2A- 5 )a/ 5 (v) = (A-3)/(v) - (A- 2 )a/ 5 (v). 


l<ii<K-2 
2 i odd 


(15) 


using Corollary [TH] Further we have: 


V- A-ti-2^ , , Cor.E] ITil A-1 A-3,, , 

c V U —- ^/ 3 (v) 


1 < 2 i<K -2 
2 i odd 


a 


2a 


Combining this with (151 gives: 

A-1 3A-9,, , A-1 ^ ^ LemmalU] _ 3 1 

- > -f(v)- af^iv) > -•- 

2a - 2 ’ 2 > - 2 9 


A- 1 


1 
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This implies 


21Q{K -1) 
2^K - ^ ” 


< 19.7 


Since a = 24, this leads to a contradiction as desired. 




[~5] Conclusions 

In this paper we have proved the Herman-Protocol Conjecture formulated by Mclver and 
Morgan in a decade ago, which says that the worst-case initial configuration consists of 
three maximally-separated tokens, for N multiple of 3. This follows from our result that the 
worst-case self-stabilization time is at most for any number of processes N and any 

odd number of tokens K. 

The proof uses a Lyapunov function approach. To do so, we first find a suitable Lyapunov 
function and then show that its maximum is Then we show that this function gives 

an upper bound for the self-stabilization time for each possible configuration in Herman’s 
algorithm. 
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I A I Proof of Lemma 


Let z : —)■ be a i^T-token configuration on a ring with N processes. 

Recall that the associated gap vector g(z) = {go, ■ ■ ■ ,gK-i) & is defined by go := 
N + z{l) — z{K) and gi := z{i + 1) — z{i) for i = 1,..., K — 1. 

Given z, consider the gap-increment vector A := g{z') — g(z), where z' is the random 
successor configuration of z. This is a random variable taking values in {—1, 0, +1}^ where, 
for each i G {0,..., AT — 1}, = 0 with probability 1/2 (the two tokens adjacent to the i-th 

gap both stay or both move clockwise), and A^ = ±1 with probability 1/4 (one token stays 
and the other moves clockwise). 

We will need the following two properties (161 and concerning the expectation of 
the random variable A. First, it is straightforward to verify by direct calculation that for 
0<k<K, 


Jo if fc is even 

E(AiAj+i... Ai+fc) = < ^,(fe+i)/2 . 

I (—j) if k IS odd 


(16) 


Secondly, suppose that 0 < < 12 < is < A < if, with 13 ^ 12 + 1 and ^ A + 1 modulo 

K, that is, {ii ,..., 12 } and { 13 ,..., ^ 4 } form two non-adjacent intervals (treating K — 1 and 
0 as adjacent). Then 


E(A,, ... A,,A ,3 ... A,J = E(A ,3 ... A,JE(A ,3 ... A,J . 


(17) 


because A^^,..., A^^ and Ai 3 ,..., A^^ are determined by the movements of disjoints sets of 
tokens, and hence are independent. 

For a given configuration z we want to compute E[/ 5 (g(z) + A)]. From the definition of 
/s and the linearity of expectation, this is a sum of expressions of the form 


E(<?io T ^* 3 )(5*4 ^* 4 ) 

over the set of indices 0 < jq < < 12 < *3 < *4 < 7^ of alternating parity. 


(18) 


Expression (18 1 evaluates to a degree-5 polynomial in the variables g. Observe that 


this polynomial has no monomials of even degree. For example, all degree-2 monomials 
have coefficients of the form E(AiAjAfc) with i < j < k. These coefficients are zero by 
(16 1 and ( [l7| ). Degrees 0 and 4 are proved similarly. 

There is a single degree-5 monomial in (18 1 —namely gig ■■ ■ gi^. Summing all such terms 
over indices 0 < io < ii < *2 < *3 < *4 < AT of alternating parity yields / 5 (g(z)). 


Expanding the expression (18 1 yields degree-3 monomials of the form 


5io 5j 1 5 E (A j3 A ) 

for distinct indices jo < ji < J 2 - The coefficient of such a term is —1/4 if ^4 = jo -(- 1 
or jo = /4 -I- 1 and 0 otherwise. Moreover, if jo,ji,j 2 have alternating parity there are 


have alternating parity then there are no such terms in (I 8 I. We conclude that the sum of 
all degree-3 monomials in E(/ 5 (g(z) 


{K — 3)/2 choices of jo such that gjggj^gj^^{/S.jg/S.jgj^i) appears in (18 1 . If jo,/i ,/2 do not 

no sue 
A) is 


(7f-3) 




Finally, consider the degree-1 monomials. These have the form 
930 E(^ii ^32 ^ 34 ,) 
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for distinct indices jo and ji < j 2 < jo < Ja- By Property 0 , such terms are only non-zero 
if {jii J 2 , ja, j 4 } comprises either a single block of adjacent indices or two non-adjacent blocks 
of length 2 (considering K —1 and 0 to be adjacent). In this case E(Ajj = 1/16, 

and there are = (K — 1){K — 3)/8 such choices of {ji , j 2 , ja, j 4 } for each choice of 

jo- Thus gjg has total coefficient {K — 1){K — 3)/128 in E(/ 5 (g(z) -I- A)). Moreover, since 
5 o + • ■ ■ + gK-i = N, the degree-1 terms in E(/ 5 (g(z) -I- A)) sum to N{K — 1){K — 3)/128. 
In summary, we have proved: 

► Proposition 17. For each K-token configuration z, 

E(/5(g(z) + A)) = /5(g(z)) - i^/3(g(z)) + 


Lemmaj^follows immediately from Propositionj^by scaling, since V^{z) = 4 A^/ 5 (g(z) /N) 
^fbisiz)) is a linear multiple of f 5 {g{z)). 


B I Proofs of Properties of an Interior Local Maximum 


Lemma |l0[ Let v be a local maximum of in the interior of and define cGM. by 

C = 0 - « X! • (19) 

l<i2<K l<i2<i3<‘i4<K 

12 even 12 , ia even 

23 odd 


This expression holds for the same value of c if the indices are rotated by an arbitrary k: for 
all j the index ij becomes {ij k) mod K. Further, we have 

0 < - ( 20 ) 

3<i3<i4<K 

23 odd 

24 even 


Again, this inequality also holds when indices are rotated. 

Proof. We consider the second-order Taylor expansion of along the direction d = 
(— 1 , 0 , 1 , 0 ,..., 0 ) (which is tangent to 

/(^)(x + ed) = /i^)(x) + eQ(x) + e2i?(x) + 0{e^) . 


Since v is a local maximum, we have Q(v) = 0 and i?(v) < 0. Proving (19) boils down to 
calculating ( 5 (x); proving ( 20 ) boils down to calculating i?(x). 


First, we prove (19). Let 

f^^\xei + e,xi,...,XK-i) = -b eP(x) -bO(e^). 

By the chain rule and using the rotational symmetry of f^^^ (Lemma|^a)), we find that 
Q{xo,. ■ ■,XK-i) = P(a:o+2,a;i+2,.. .,xk-i+ 2) - P{xo,xi,.. .,xk-i)- 
Now recall the definition of f^^^: 




^ (x) . / ^ '*^20*^21 •*'22 

0 <2o<n<^2<^ 

22 — 2i and 2i — 2o odd 


E 


E 




20 **^21 **^22 •*'23 •*'24 

0<2o<---<24<i^ 

^4 ~ '^ 3 » • • • » ~ ^0 odd 


( 21 ) 
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We differentiate with respect to xq to obtain 


P(x) = ^ ^ aXi^Xi^Xi^Xi^. (22) 

0 <il<i 2 <K 0 <ii<---<i 4 <K 

ii odd ii, 23 odd 

22 even 22,^4 even 


Since v is a local maximum, Qiy) = 0 and we have 


V4,Vi^ - Y OLVi^Vi^Vi^V^^ 

Q<ii<i 2 <K Q<ix<---<iA<K 

21 odd 2i, 23 odd 

22 even 22,^4 even 


Y, '*^*l+2^'i2+2 - Y^ OiVi^j^2Vi^+2Vi^+2Vi^+2 

0<ii<i2<K 0<ii<---<i4.<K 

21 odd 2i, 23 odd 

22 even 22,24 even 


Observe that the monomials not containing vi cancel each other out. Dividing by vi = Vi^x 
(since Ui > 0), we have 


- Y o:'>J^2Vi3Vi4 

l<i2<K 1<22<23<^4<^ 

22 even 23 odd 

22,24 even 


Y, “ Y^ OiVi^+2Vi2+2Vis+2 

0 <ii<K — l 0 <ii<i 2 <i 3 <K—l 
ii odd ii, 23 odd 

22 even 


Now we observe that the right hand side can be obtained from the left hand side by changing 
each index i into i + 1. Taking into account rotations of the above equality, we conclude (|19[). 


Next, we prove (20). To do so, we first calculate the terms of order of /^^^(x + ed). 
Such terms occur only when zq = 0, zi = 1, and Z 2 = 2. In this case, the first sum reduces to 
{xq — e)xi{x 2 + e), and the second sum reduces to 


a{xQ - e)xi{x 2 + e) Y 

2<i3<iA<K 
23 odd, 24 even 


Thus, 


i?(x) = —Xi + axi 




2<23 <ii4<K 
23 odd, 24 even 


Since the assumed interior local maximum v is in the interior of we have that vi > 0, 

and so the condition i?(v) < 0 is equivalent to R{v)/vi < 0: 

-1 + Y, OiVi^Vi^ < 0 

2 < 23 < 24 <_fC 
23 odd, 24 even 


Up to trivial rearrangement, we obtained (20). 


◄ 


Corollary 


11 


Let V be a local maximum of in the interior of . Then the 


following inequality holds: 


Y 

l<i<K -2 
2 odd 



< 


K 

a 
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Proof. We sum (20) over all K rotations: 


K 

a 


K-l 

E 

i—0 3<23<24<iC 

23 odd 

24 even 


K-l 

^ ^ ^ ^ '^^23+z'^Z4+2 = ^ ^ *^24 —^3 (^) 

3<23<24<^ "i—0 3<23<24<^ 

^3 odd 23 odd 

24 even 24 even 


= E = E E = E ^ 2 

3<23<23+2<i^ 1<2 3<23<iC —2 l< 2 </i' —2 

2 odd, 23 odd 2 odd 23 odd 2 odd 




C I Proofs of Combinatorial Lemmas 


We repeat the combinatorial facts of Section this time with proofs. 


Lemma 


We have: 


K-l 

E E ^2Q + fc^2^+/c^22+fc 

k^O l<i'Q<i[<i'^<K 
2q, 22 e2;en 
i\ odd 


K-3 
2 


E 


K-3 


20*^21 
0<2o<2l<22</Sr 
^2 ~ U j H ~ "^0 




/f^x) 


Proof. Let us fix 0 < iq < ii < ^2 < such that both i 2 — and ii — io are odd. We 
want to show that the term Xi^Xi^Xi^ occurs {K — 3)/2 times in each side of the equality. 
The middle and right sides are trivial; it remains to check the left side. Let us now fix an 
arbitrary k. For a term on the left hand side to equal Xi^Xi^Xi^, it must be that the sets 
{(zq + k) mod K, {i\ + k) mod K, (i'^ + k) mod K} and {io, ii, * 2 } are equal. In other words, 
once io,ii,i 2 ,k are fixed, the set {* 01 * 11 * 2 } is uniquely determined. Since, *o < *{ < * 2 , the 
potential values of *o ,*{,*2 are also uniquely determined. The remaining question is for how 
many fc G { 0 ,..., if — 1 } it is the case that the values * 0 , *{, *2 so determined obey the other 
constraints. 

There are three disjoint cases: The smallest value in the set {*o,*i,* 2 }, namely Iq, is 
(*o — k) mod K or (ii — k) mod K or (12 — k) mod K. The case *o = (*i — k) mod K occurs 
exactly when (a) *0 < k < ii, and (b) k has the same parity as *i. Let Sq denote the size of 
the gap between io and ii. Then, there are ((5o — l)/2 values of k that obey both (a) and (b). 
The other two cases are similar, and so we conclude that the term Xi^Xi-^Xi^ occurs on the 
left hand side 

2 2 2 2 

times. ◄ 


14 


Let v be a local maximum of in the interior of If ii is odd and 


Lemma 

0 < ii < if, then the following inequality holds: 


VoVii f E ^*2 

22 even 


^ av^^Vi^Vi^ 


1<22<23<24<J^ 
22,24 even 
23 odd 


> VQVi^ 


ii <i2<K 


Vio 



22, 24 even 
23 odd 
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Proof. The proof below is a case analysis of where i\ can be inserted in-between 0 < 12 < 
is < i 4 < K. As noted before, the task is to show that retaining the terms that occur in /s 
gives a lower bound. In other words, we want to show that those terms not occurring in /s 
have a positive sum. We calculate this sum: 


- y] avoVi^v^^v^^Vi^ 

l<i2<ii l<i2<i3<i4<K 

22 even ^2<*i 

= vov^^v,^(l- aVi^Vi^ 

1 <22<U 22<^3<^4<^ 

22 even 23 odd, 24 even 


1 < 22<*1 3 < 23 < 24 </ S ' 

22 even 23 odd, 24 even 



0 




Lemma 15 


Let I be an odd, positive integer. Then: 


K-l 


Y. ^ Y xkxp^+k n 




l<i'^<K -2 
i\ odd 


vt, i' =i (mod 2 ) 


l<i<i 

1-1 


K-l 


) E 


Z -1 

n 


0<zo<'"<ii-i<-R’ i=0 

ij — ij — i odd for 0 < j < I 


The proof is similar to that of Lemma 

Proof. Let us fix 0 < jq < • • • < *;-i < AT with odd gaps in-between. We want to show that 
the term Xi^ ... Xi,_„^ occurs {I — l)K/2 — I times on each side of the equation. For the right 
side, it is trivial. The general form of a term on the left side is ■ ■ - xp^ It 

must be that k is one of iq, ■ • ■, ii-i- Let us consider the case k = iq; the others are similar. 
If fc = io, then, in fact, 

{k,i[ + k,i 2 +k,... ,i'i_i + k) mod K = (io,ii,...,q-i). 

In particular, i'l equals the size of the gap between io and ii. Let us denote this gap by (5o. 
On the left hand side, the term is multiplied by {K — i'l — 2)/2, which is (AT — (5o — 2)/2. The 
cases k = ii, k = 12 , ... are similar. Because <5o -f • • • -f <5/_i = AT, we conclude that the term 
Xig ■. ■ occurs 

K-So-2 ^ , K-Si_4-2 1-1^ , 

- 2 -+ ■■■+ - 2 - = ' 

times on the left side. ◄ 
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